013.md

Attractive Orchid Chipmunk

High

The attacker will prevent any SetterFunction by calling MultiSign::executeSetterFunction before the admin calls it

Summary

The MultiSign::executeSetterFunction function is vulnerable to abuse because it is an external function that allows anyone to call if its status is getSetterFunctionApproval(_function) >= requiredApprovals. An attacker could exploit this by repeatedly calling executeSetterFunction whenever a set function is available to be executed.

Root Cause

The root cause of this issue lies in the design of the function:

1. The function is external, meaning it can be called by anyone.
2. When called, it checks the getSetterFunctionApproval(_function) >= requiredApprovals, then changes approvedToUpdate from true to false. This occurs in a temporary state before the admin calls setter functions like Borrowing::setAPR.
3. This creates a window of opportunity for a DoS attack.
4. As a result, setter functions will always revert.

Internal pre-conditions

There must be a state with getSetterFunctionApproval(_function) >= requiredApprovals.

External pre-conditions

The attacker needs to monitor the contract to identify when getSetterFunctionApproval(_function) >= requiredApprovals

Then, they must execute MultiSign::executeSetterFunction before the admin calls setter functions such as Borrowing::setAPR.

Attack Path

1. An attacker monitors the contract to detect when a getSetterFunctionApproval(_function) >= requiredApprovals state.
2. As soon as this state, the attacker calls the MultiSign::executeSetterFunctionfunction.

Impact

This vulnerability allows a malicious actor to disrupt the entire system by preventing any set function from executing.

Mitigation

Add access control to MultiSign::executeSetterFunction.